>все правила pf ?

# Interfaces
int_if="rl0"
ext_if="rl1"

# routers IPs
int_ip="192.168.0.2"
ext_ip="xxx.xxx.xxx.xxx"

# Other IPs
local_net="192.168.0.0/24"
tfs_ip="192.168.0.60"
ftp_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"
o_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"
vpn_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"
dns_ip="{ xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx }"

# Stateful macros
syn_state="flags S/SA synproxy state"
tcp_state="flags S/SA modulate state"
udp_icmp_state="keep state"

# Allow ports
common_ports="{ ssh, aol, ircd, rdp, 8080 }"
me_tcp_ports="{ www, https, 3128, ssh }"
me_udp_ports="{ domain, ntp }"
mail_ports="{ pop3, pop3s, smtp, smtps }"
ipsec_ports="{ 500, 4500, 10000, 20000 }"
ftp_port="8021"
dhcpd_ports="{ 67, 68 }"
wow_ports="{ 3724, 8879 }"
cod_ports="28960"

# ICMP-types macros
icmp_good="icmp-type 8 code 0"

# Stateful tracking options macros
www_track="(max 300, source-track rule, max-src-conn 100, max-src-nodes 50, max-src-states 5)"
ftp_track="(max-src-conn 5, max-src-conn-rate 3/30, overload <ftp-bruteforce> flush global)"
ssh_track="(max-src-conn 5, max-src-conn-rate 3/30, overload <ssh-bruteforce> flush global)"

# Table
table <ssh-bruteforce> persist
table <ftp-bruteforce> persist

# Misc Options
set debug urgent
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none

# Timeout Options
set optimization normal
set timeout { frag 30, tcp.established 28800 }
set timeout { tcp.first 120, tcp.closing 120, tcp.closed 120, tcp.finwait 120 }
set timeout { udp.first 120, udp.single 120, udp.multiple 120 }
set timeout { adaptive.start 6000, adaptive.end 12000 }

################ Skip ######################################
set skip on lo

################ Normalization #############################
scrub in log on $ext_if all random-id  fragment reassemble
scrub    log on $ext_if all reassemble tcp

################ Translation ###############################
no rdr on lo0 from any to any

nat on $ext_if from !($ext_if) to any -> ($ext_if:0)

# Ftp ( secure ftp-proxy for the internal LAN )
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $int_if inet proto tcp from $int_if:network to !$int_ip port ftp -> lo0 port $ftp_port

########### TFS redirect ##############
rdr on $ext_if inet proto tcp from any     to $ext_ip port 83   -> $tfs_ip port 83
rdr on $ext_if inet proto tcp from $o_ip   to $ext_ip port rdp  -> $tfs_ip port rdp
rdr on $ext_if inet proto tcp from any     to $ext_ip port 8080 -> $tfs_ip port 8080
rdr on $ext_if inet proto tcp from $o_ip   to $ext_ip port 1433 -> $tfs_ip port 1433

################ Filtering #################################
# Deny bruteforce Atacks
block drop in quick on $ext_if from <ssh-bruteforce>
block drop in quick on $ext_if from <ftp-bruteforce>

# Deny spoofed packets
antispoof log quick for { lo0 $int_if }

# Drop to/from illegal sources/destinations
block        quick inet6
block in log quick            from no-route to any
block in     quick on $ext_if from any      to 255.255.255.255

# BLOCK all in/out on all interfaces and log by default
block        log on $ext_if
block return log on $int_if

#Block NMAP
block quick from any os NMAP

# Ftp ( secure ftp-proxy )
anchor "ftp-proxy/*"

# Icmp from any to any
pass log inet proto icmp from any to any $icmp_good

# In from $local_net to me
pass in  log on $int_if inet proto udp from 0.0.0.0         port bootpc to 255.255.255.255 port bootps            $udp_icmp_state tag Local_DHCPD
pass out log on $int_if inet proto udp from 255.255.255.255 port bootps to 0.0.0.0         port bootpc            $udp_icmp_state tag Local_DHCPD
pass in  log on $int_if inet proto udp from $local_net      port bootpc to $int_ip         port bootps            $udp_icmp_state tag Local_DHCPD
pass in  log on $int_if inet proto tcp from $local_net                  to lo0             port $ftp_port         $tcp_state      tag Local_FTP-PROXY
pass in  log on $int_if inet proto tcp from $local_net                  to $int_ip         port $me_tcp_ports     $tcp_state
pass in  log on $int_if inet proto udp from $local_net                  to $int_ip         port $me_udp_ports     $udp_icmp_state
pass in  log on $int_if inet proto tcp from $local_net                  to $int_ip         port { ftp, ftp-data } $tcp_state      tag Local_active_FTPD
pass in  log on $int_if inet proto tcp from $local_net                  to $int_ip         port 65500:65535       $tcp_state      tag Local_passive_FTPD

# In from any to me
pass in quick log on $ext_if inet proto tcp from any to $ext_ip port ssh               $tcp_state $ssh_track tag INTERNET_SSHD
pass in quick log on $ext_if inet proto tcp from any to $ext_ip port { ftp, ftp-data } $tcp_state $ftp_track tag INTERNET_ACTIVE_FTPD
pass in quick log on $ext_if inet proto tcp from any to $ext_ip port 65500:65535       $tcp_state            tag INTERNET_PASSIVE_FTPD

# In from any to $local_net
pass log inet proto tcp from any     to $tfs_ip port 83   $tcp_state
pass log inet proto tcp from any     to $tfs_ip port 8080 $tcp_state
pass log inet proto tcp from $o_ip   to $tfs_ip port rdp  $tcp_state
pass log inet proto tcp from $o_ip   to $tfs_ip port 1433 $tcp_state

# In from $local_net to any
pass in log on $int_if inet proto tcp          from $local_net to any     port $common_ports $tcp_state
pass in log on $int_if inet proto tcp          from $local_net to any     port $mail_ports   $tcp_state
pass in log on $int_if inet proto tcp          from $tfs_ip    to $o_ip   port { www, 8080 } $tcp_state
pass in log on $int_if inet proto { tcp, udp } from $local_net to $o_ip   port $ipsec_ports  $udp_icmp_state
pass in log on $int_if inet proto tcp          from $local_net to any     port $wow_ports    $tcp_state
pass in log on $int_if inet proto tcp          from $local_net to $vpn_ip port pptp          $tcp_state
pass in log on $int_if inet proto gre          from $local_net to $vpn_ip                    $udp_icmp_state

# Out from $local_net, me to any
pass  out log on $ext_if inet proto tcp              to any                  $tcp_state
pass  out log on $ext_if inet proto udp              to any                  $udp_icmp_state
pass  out log on $int_if inet proto udp from $int_ip to $local_net port snmp $udp_icmp_state
block out log on $ext_if inet proto { tcp udp } to any port $dhcpd_ports